Virtual object access control mediator

Abstract

A method and system for structuring an object in security policies of a computer system includes: receiving a request to access a virtual volume with a virtual name; mapping the virtual name to the real object; and providing the real object. The method and system uses virtual objects which map to real objects in a computer system. The access control mediator grants or denies access to a virtual object using a discretionary or a mandatory policy. A virtual name is mapped to a real object. This mapping is transparent to the subject. In this manner, security policies can be enforced over objects stored in file systems without regard to the policies of the file systems. The system can also be used as a gateway to remote file systems built on top of existing file systems. These advantages provide more flexibility in controlling a subject's access to real objects.

What is claimed is:  
     
         1 . A method for providing access control to a real object in a computer system, comprising the steps of: 
 (a) receiving a request to access a virtual volume with a virtual name;    (b) mapping the virtual name to the real object; and    (c) providing the real object.    
     
     
         2 . The method of  claim 1 , wherein prior to the receiving step (a) comprises: 
 (a1) authenticating a subject; and    (a2) determining that the subject has a right to access the virtual volume.    
     
     
         3 . The method of  claim 1 , wherein the mapping step (b) comprises: 
 (b1) determining that a virtual path in the virtual name points to a virtual object in the virtual volume; and    (b2) determining that the virtual object points to the real object.    
     
     
         4 . The method of  claim 1 , wherein the mapping step (b) comprises: 
 (b1) determining that a virtual path in the virtual name points to a virtual object in the virtual volume;    (b2) determining that the virtual object points to a real directory; and    (b3) determining that a real subpath in the virtual name points to the real object under the real directory.    
     
     
         5 . The method of  claim 1 , wherein the mapping step (b) comprises: 
 (b1) determining that a virtual path in the virtual name points to a virtual directory in the virtual volume;    (b2) determining that a virtual subpath in the virtual name points to a virtual object under the virtual directory; and    (b3) determining that the virtual object points to the real object.    
     
     
         6 . The method of  claim 1 , wherein the mapping step (b) comprises: 
 (b1) determining that a virtual path in the virtual name points to a virtual directory in the virtual volume;    (b2) determining that a virtual subpath in the virtual name points to a virtual object under the virtual directory;    (b3) determining that the virtual object points to a real directory; and    (b4) determining that a real subpath in the virtual name points to the real object under the real directory.    
     
     
         7 . A method for providing access control to a real object in a computer system, comprising the steps of: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path;    (b) determining that the virtual path points to a virtual object in the virtual volume;    (c) determining that the virtual object points to the real object; and    (d) providing the real object.    
     
     
         8 . A method for providing access control to a real object in a computer system, comprising the steps of: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path and a real subpath;    (b) determining that the virtual path points to a virtual object in the virtual volume;    (c) determining that the virtual object points to a real directory;    (d) determining that the real subpath points to the real object under the real directory; and    (e) providing the real object.    
     
     
         9 . A method for providing access control to a real object in a computer system, comprising the steps of: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path and a virtual subpath;    (b) determining that the virtual path points to a virtual directory in the virtual volume;    (c) determining that the virtual subpath points to a virtual object under the virtual directory;    (d) determining that the virtual object points to the real object; and    (e) providing the real object.    
     
     
         10 . A method for providing access control to a real object in a computer system, comprising the steps of: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path, a virtual subpath, and a real subpath;    (b) determining that the virtual path points to a virtual directory in the virtual volume;    (c) determining that the virtual subpath points to a virtual object under the virtual directory;    (d) determining that the virtual object points to a real directory;    (e) determining that the real subpath points to the real object under the real directory; and    (f) providing the real object.    
     
     
         11 . A system, comprising: 
 a virtual volume, comprising a virtual object;    a real volume, comprising a real object; and    a virtual name, wherein the virtual name is used to access the virtual object, wherein the virtual object is mapped to the real object.    
     
     
         12 . The system of  claim 11 , wherein the virtual name comprises a virtual path, 
 wherein the virtual path points to the virtual object,    wherein the virtual object points to the real object.    
     
     
         13 . The system of  claim 11 , wherein the real volume further comprises a real directory, wherein the real object is under the real directory, 
 wherein the virtual name comprises a virtual path and a real subpath,    wherein the virtual path points to the virtual object,    wherein the virtual object points to the real directory,    wherein the real subpath points to the real object.    
     
     
         14 . The system of  claim 11 , wherein the virtual volume further comprises a virtual directory, wherein the virtual object is under the virtual directory, 
 wherein the virtual name comprises a virtual path and a virtual subpath,    wherein the virtual path points to the virtual directory,    wherein the virtual subpath points to the virtual object,    wherein the virtual object points to the real object.    
     
     
         15 . The system of  claim 11 , wherein the virtual volume further comprises a virtual directory, wherein the virtual object is under the virtual directory, 
 wherein the real volume further comprises a real directory, wherein the real object is under the real directory,    wherein the virtual name comprises a virtual path, a virtual subpath, and a real subpath,    wherein the virtual path points to the virtual directory,    wherein the virtual subpath points to the virtual object,    wherein the virtual object points to the real directory,    wherein the real subpath points to the real object.    
     
     
         16 . A computer readable medium with program instructions for providing access control to a real object in a computer system, comprising the instructions for: 
 (a) receiving a request to access a virtual volume with a virtual name;    (b) mapping the virtual name to the real object; and    (c) providing the real object.    
     
     
         17 . The medium of  claim 16 , wherein prior to the receiving instruction (a) comprises instructions for: 
 (a1) authenticating a subject; and    (a2) determining that the subject has a right to access the virtual volume.    
     
     
         18 . The medium of  claim 16 , wherein the mapping instruction (b) comprises instructions for: 
 (b1) determining that a virtual path in the virtual name points to a virtual object in the virtual volume; and    (b2) determining that the virtual object points to the real object.    
     
     
         19 . The medium of  claim 16 , wherein the mapping instruction (b) comprises instructions for: 
 (b1) determining that a virtual path in the virtual name points to a virtual object in the virtual volume;    (b2) determining that the virtual object points to a real directory; and    (b3) determining that a real subpath in the virtual name points to the real object under the real directory.    
     
     
         20 . The medium of  claim 16 , wherein the mapping instruction (b) comprises instructions for: 
 (b1) determining that a virtual path in the virtual name points to a virtual directory in the virtual volume;    (b2) determining that a virtual subpath in the virtual name points to a virtual object under the virtual directory; and    (b3) determining that the virtual object points to the real object.    
     
     
         21 . The medium of  claim 16 , wherein the mapping instruction (b) comprises instructions for: 
 (b1) determining that a virtual path in the virtual name points to a virtual directory in the virtual volume;    (b2) determining that a virtual subpath in the virtual name points to a virtual object under the virtual directory;    (b3) determining that the virtual object points to a real directory; and    (b4) determining that a real subpath in the virtual name points to the real object under the real directory.    
     
     
         22 . A computer readable medium with program instructions for providing access control to a real object in a computer system, comprising the instructions for: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path;    (b) determining that the virtual path points to a virtual object in the virtual volume;    (c) determining that the virtual object points to the real object; and    (d) providing the real object.    
     
     
         23 . A computer readable medium with program instructions for providing access control to a real object in a computer system, comprising the instructions for: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path and a real subpath;    (b) determining that the virtual path points to a virtual object in the virtual volume;    (c) determining that the virtual object points to a real directory;    (d) determining that the real subpath points to the real object under the real directory; and    (e) providing the real object.    
     
     
         24 . A computer readable medium with program instructions for providing access control to a real object in a computer system, comprising the instructions for: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path and a virtual subpath;    (b) determining that the virtual path points to a virtual directory in the virtual volume;    (c) determining that the virtual subpath points to a virtual object under the virtual directory;    (d) determining that the virtual object points to the real object; and    (e) providing the real object.    
     
     
         25 . A computer readable medium with program instructions for providing access control to a real object in a computer system, comprising the instructions for: 
 (a) receiving a request to access a virtual volume with a virtual name, wherein the virtual name comprises a virtual path, a virtual subpath, and a real subpath;    (b) determining that the virtual path points to a virtual directory in the virtual volume;    (c) determining that the virtual subpath points to a virtual object under the virtual directory;    (d) determining that the virtual object points to a real directory;    (e) determining that the real subpath points to the real object under the real directory; and    (f) providing the real object.